From de1431d175dde7acf91d0c00e3a46aef478695d0 Mon Sep 17 00:00:00 2001
From: randogoth <kflux@posteo.de>
Date: Tue, 10 Feb 2026 08:27:59 +0200
Subject: [PATCH] tailscale

---
 modules/system/networking.nix | 11 ++++++++++-
 modules/system/packages.nix   |  1 +
 modules/system/services.nix   |  4 ++++
 3 files changed, 15 insertions(+), 1 deletion(-)

diff --git a/modules/system/networking.nix b/modules/system/networking.nix
index 45bc069..efbee10 100644
--- a/modules/system/networking.nix
+++ b/modules/system/networking.nix
@@ -1,5 +1,14 @@
 { lib, ... }:
 
 {
-  networking.useDHCP = lib.mkDefault true;
+  networking = {
+    useDHCP = lib.mkDefault true;
+    nftables.enable = true;
+    firewall = {
+      enable = true;
+      trustedInterfaces = [ "tailscale0" ];
+      allowedUDPPorts = [ config.services.tailscale.port ];
+    };
+  systemd.network.wait-online.enable = false;
+  boot.initrd.systemd.network.wait-online.enable = false;
 }
diff --git a/modules/system/packages.nix b/modules/system/packages.nix
index a3b1f6e..2615302 100644
--- a/modules/system/packages.nix
+++ b/modules/system/packages.nix
@@ -9,6 +9,7 @@
     pkgs.distrobox
     pkgs.distroshelf
     pkgs.dnsmasq
+    pkgs.ethtool
     pkgs.fastfetch
     pkgs.flatpak
     pkgs.git
diff --git a/modules/system/services.nix b/modules/system/services.nix
index 57a8ed4..edd4165 100644
--- a/modules/system/services.nix
+++ b/modules/system/services.nix
@@ -15,5 +15,9 @@
       pulse.enable = true;
       jack.enable = true;
     };
+    tailscale.enable = true;
+    tailscaled.serviceConfig.Environment = [ 
+      "TS_DEBUG_FIREWALL_MODE=nftables" 
+    ];
   };
 }